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Re: Freedom of Information Act (FOIA) Request #19-OIG-F-00621/2019-45 
Dear Ms. Crose: 

This letter concerns a June 25, 2019, Freedom of Information Act (FOIA) request that you 
submitted to the NASA FOIA Office at the Jet Propulsion Laboratory in Pasadena, California. 
Your request was referred to the NASA Office of Inspector General (OIG) for processing, as it 
seeks records of the NASA OIG, and was assigned tracking number 19-OIG-F-00621/2019-45. 
Pursuant to the FOIA (5 U.S.C. § 552), you requested certain NASA OIG investigative 
documents. Specifically you requested: 

[A]ny investigative records related to the hacking of a JPL controlled raspberry pi 
relevant to the attached [news] report in any recorded format. Please include 
memorandums, email exchanges, and other relevant slideshow presentations or detailed 
documentation between investigative teams and leadership with regards to this hack. 

Your request referenced a June 24, 2019, news story titled “Raspberry Pi used to steal data from 
Nasa lab,” which was published on the web site https://www.bbc.com . That news story was 
reporting on findings contained in a June 18, 2019, audit report published by the NASA OIG, 
Cybersecurity Management and Oversight at the Jet Propulsion Laboratory (IG-19-022). This 
report can be found at: https://oig.nasa.gov/docs/IG-19-022.pdf 

Associated responsive records from the investigative file are non-releasable based upon the 
exemption at 5 U.S.C. §552 (b)(7)(A), which authorizes the withholding of records or 
information compiled for law enforcement purposes to the extent that production of such law 
enforcement records or information could reasonably be expected to interfere with enforcement 
proceedings. In making the decision to publish certain details concerning the April 2018 
cyberattack which is the subject of your request, the NASA OIG had to carefully weigh the 











competing interests of Governmental transparency and investigative confidentiality. OIG Audit 
Report IG-19-022 strikes the appropriate balance between those important interests. However, 
release of investigative records could reasonably be expected to interfere with ongoing law 
enforcement investigation of that matter. 

For your information, Congress excluded three discrete categories of law enforcement and 
national security records from the requirements of the FOIA. See 5 U.S.C. § 552(c) (2006 & 
Supp. IV 2010). This response is limited to those records that are subject to the requirements of 
the FOIA. This is a standard notification that is given to all our requesters and should be taken 
as an indication that excluded records do, or do not, exist. 

You may contact our FOIA Public Liaison, Francis P. LaRocca at 202-358-2575 for any further 
assistance and to discuss any aspect of your request. Additionally, you may contact the Office of 
Government Information Services (OGIS) at the National Archives and Records Administration 
to inquire about the FOIA mediation services they offer. The contact information for OGIS is as 
follows: Office of Government Information Services, National Archives and Records 
Administration, 8601 Adelphi Road-OGIS, College Park, Maryland 20740-6001, e-mail at 
ogis@nara.gov : telephone at 202-741-5770; toll free at 1-877-684-6448; or facsimile at 
202-741-5769. 

You also have the right to appeal this initial determination to the Deputy Inspector General. 
Pursuant to 14 CFR §1206.700(b), the appeal must (1) be in writing; (2) be addressed to the 
following: 


NASA, Office of Inspector General 
Headquarters 

300 E Street, SW, Suite 8V39 
Washington, D.C. 20546-0001 
Attn: George A. Scott, Deputy Inspector General; 


(3) be identified clearly on the envelope and in the letter as “Freedom of Information Act 
Appeal”; (4) include a copy of the request for the Agency record and a copy of the adverse initial 
determination; (5) to the extent possible, state the reasons why the requester believes the adverse 
initial determination should be reversed; and (6) must be postmarked and sent to the Deputy 
Inspector General within 90 calendar days of the date of receipt of the initial determination. 
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